CISA, the NSA, and more than two dozen partner agencies warned on July 23, 2026 that Russian state hackers tracked as LAUNDRY BEAR exploited a Zimbra webmail flaw to read email and harvest two-factor codes since at least July 2025.
Quick Summary – TLDR:
- CISA, the NSA, the FBI, and more than two dozen partner agencies jointly warned that a Russian group is reading victims’ email through a Zimbra webmail flaw.
- The bug, CVE-2025-66376, is a stored cross-site scripting flaw Zimbra fixed on November 6, 2025, months after exploitation began, according to Proofpoint.
- Viewing the malicious email alone triggers the exploit, with no link to click or file to open required.
- The payload mints a fake app-specific credential named “ZimbraWeb” and can quietly turn on IMAP access to hold a second foothold.
- App-specific passwords survive password resets, researchers found, so patching Zimbra alone will not secure a compromised account.
What Happened?
LAUNDRY BEAR’s campaign breaks from ordinary phishing, the CISA advisory said. Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service.
The flaw, CVE-2025-66376, is a stored cross-site scripting vulnerability in Zimbra’s Classic UI. Webmail is a recurring entry point for distributed teams, per SQMagazine’s Remote Work Security Data.
Unit 42, per Palo Alto Networks, also contributed research to the joint advisory. A crafted HTML email abuses CSS import handling to run hidden JavaScript the moment the message renders inside the victim’s logged-in mailbox.
Once triggered, the script creates a new app-specific credential named “ZimbraWeb” via the CreateAppSpecificPasswordRequest command. In one case Seqrite analyzed, at a Ukrainian state hydrology agency, the payload also flipped the zimbraPrefImapEnabled setting to TRUE for a second, quieter foothold.
LAUNDRY BEAR is also tracked as Void Blizzard, CL-STA-1114, and TA488, though cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding.
Our researchers discovered that a Russia-aligned threat actor was exploiting a previously unknown (zero-day) vulnerability against Zimbra mailservers.
— Threat Insight (@threatinsight) July 23, 2026
We alerted gov’t partners, with whom we have collaborated on further discovery. @NSACyber @FBI
Blog: https://t.co/nh2yv0wo8x. pic.twitter.com/zCbSyJaHns
App Passwords Are the Bigger Story, Not Just Zimbra’s
The mechanism LAUNDRY BEAR abuses isn’t unique to Zimbra. An app-specific password built for legacy protocols like IMAP skips two-factor authentication by design, the same design this campaign used to outlast a password reset. Microsoft 365’s legacy authentication and Google Workspace’s app passwords carry the same trade-off: older client compatibility over the 2FA gate.
So this is a reusable template, not a one vendor bug: audit app-specific passwords wherever they exist.
Why “Don’t Click” Won’t Save You Here?
Most phishing defense leans on training people not to click a link or open a file. This exploit removes that decision entirely. It fires on render, so the “train the user” control class stops reducing exposure here. The risk shifts to patch speed and account hygiene, not user judgment.
The scoring split makes the same point. NVD scores the bug 6.1 and says viewing the message counts as user interaction, while MITRE scores it 7.2 and says it does not.
Unit 42 calls the technique zero-click. All three describe the same behavior: the message runs when it renders, and nothing else has to happen. The disagreement is over labeling, not danger.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on March 18, 2026, a more useful trigger for a defender than any CVSS number.
The First 24 Hours: A Triage Order, Not a Checklist
CISA and outside researchers list mitigations and indicators as a flat catalog. The value for a resource-constrained team is in the order: patch first since it stops the next email from running, review accounts second since an unpatched clock keeps ticking regardless, hunt logs last since that step only shows what already happened.
- Patch. The flaw affects Zimbra Collaboration 10.0 before 10.0.18 and 10.1 before 10.1.13. Zimbra 10.0 has reached end-of-life, so treat 10.0.18 as an emergency floor, not a destination.
- Assume compromise. Revoke every Application Passcode and 2FA scratch key organization-wide, and disable IMAP access on any account with no business need for it.
- Hunt. Search mailbox logs for CreateAppSpecificPasswordRequest and GetScratchCodesRequest tied to unfamiliar sessions, then filter DNS for published C2 domains.
Smaller IT teams without a dedicated patch-management function are typically slowest to work through this sequence.
SQ Magazine’s Takeaway
This reads as less of a Zimbra story and more as proof that the “legacy protocol needs an escape hatch from 2FA” pattern is now an active target. User training cannot close a gap a user never gets to open or close, which is why account review matters as much as the version number.
What’s next: expect the same view-based approach against other webmail platforms that still offer an app-password bypass, and expect CVSS-only triage to keep under-ranking bugs like this one. Treat every app-specific password as a live credential to inventory and rotate, and treat the Known Exploited Vulnerabilities listing, not the score, as what moves a patch to the front of the queue.
